Consent Manager under the DPDP Act: who can register, and what it means for your business

What a Consent Manager does

The Act defines a Consent Manager as a person registered with the Board who acts as a single point of contact to enable a Data Principal to give, manage, review and withdraw her consent through an accessible, transparent and interoperable platform (section 2(g)).

• A person may give, manage, review or withdraw her consent to a business through a Consent Manager (section 6(7)).
• The Consent Manager is accountable to that person and acts on her behalf (section 6(8)), in a fiduciary capacity (First Schedule, Part B, item 8).
• It must not be able to read the personal data that is shared through it (Part B, item 2).
• It keeps a record of consents given, denied or withdrawn, of the notices that come with each request for consent, and of data shared with another business. It keeps this record for at least seven years; the person can see it and ask for it in machine-readable form (Part B, items 3 and 4).

The Rules give an example (Part B, item 1): bank B1 asks X on the platform for consent to use her bank statement. X can give her consent to B1 directly and share the statement from her digital locker. Or she can route her consent through her own bank B2, which then sends the statement to B1.

Who can register (Rule 4, First Schedule Part A)

The applicant must meet every condition of Part A:

• It is a company incorporated in India.
• Its net worth is at least ₹2 crore: total assets less liabilities, as in its books of account.
• It has the technical, operational and financial capacity to meet its obligations, and its financial condition and the general character of its management are sound.
• The volume of business likely to be available to it, its capital structure and its earning prospects are adequate.
• Its directors, key managerial personnel and senior management have a general reputation and record of fairness and integrity.
• Its memorandum and articles of association require it to avoid conflicts of interest with Data Fiduciaries (Part B, items 9 and 10), with policies to ensure this, and these provisions can be amended only with the Board's prior approval.
• Its proposed operations are in the interests of Data Principals.
• It is independently certified that its interoperable platform is consistent with the data protection standards and assurance framework the Board publishes on its website, and that measures are in place to follow them.

The application gives the particulars, information and documents that the Board publishes on its website (Rule 4(1)). The Board may inquire, then either registers the applicant and publishes its particulars on its website, or rejects the application with reasons (Rule 4(2)).

Duties after registration (First Schedule Part B)

• It runs a website or app, or both, as the main way people use its services (item 5).
• It must not sub-contract or assign its obligations (item 6), and must take reasonable security safeguards to prevent a personal data breach (item 7).
• It publishes its promoters, directors, key managerial personnel and senior management, every shareholder with more than 2%, and every body corporate in which any of those people holds more than 2% (item 11).
• It audits its controls, its conditions of registration and its obligations, and reports the outcome to the Board periodically (item 12).
• Control of the company cannot pass by sale, merger or otherwise without the Board's prior approval (item 13).
• From 13 May 2027, it must offer a way to raise grievances (section 13) and publish the time it takes to answer them, at most 90 days (Rule 14(3)).

If a Consent Manager does not follow these conditions and obligations, the Board may, after hearing it, direct it to fix that, and may suspend or cancel its registration (Rule 4(4) and (5)).

What it means for your business

• Using a Consent Manager is the person's choice: she "may" give, manage, review or withdraw her consent through one (section 6(7)). We found nothing in the Act or the Rules that says a business must join a Consent Manager's platform.
• The Rules speak of businesses "onboarded onto" a platform that send requests for consent there (Part B, item 1). They do not say how a business is onboarded.
• Your notice does not change. A request for consent made through a platform still comes with your notice, which the Consent Manager records (Part B, item 3(b)); Rule 3 says what the notice must contain.
• A withdrawal made through a Consent Manager is a withdrawal (section 6(7)). You must then stop processing, and make your processors stop, within a reasonable time, unless the law requires or allows the processing (section 6(6)).

The dates

• 13 November 2026: Rule 4 (registration and obligations of Consent Managers), section 6(9) (registration with the Board) and section 27(1)(d) (the Board's inquiry into a breach of a condition of registration) (Rule 1(3), G.S.R. 843(E)).
• 13 May 2027: section 6(7) and (8) (giving consent through a Consent Manager, its accountability), section 13 (grievances) and the duties of businesses (G.S.R. 843(E)).

So Consent Managers can be registered from 13 November 2026, but giving consent through one, and most duties of businesses, apply from 13 May 2027.

What to do now

• For most businesses nothing changes on 13 November 2026. Plan for 13 May 2027: a notice, consent records, an easy way to withdraw consent, grievance handling and breach intimation.
• If you ask many people for consent, watch the Board's website for the Consent Managers it registers (Rule 4(2)(a)) and decide whether to accept consent through them.
• If you want to become a Consent Manager, check each condition of Part A, and the particulars the Board publishes for the application (Rule 4(1)).

Questions